Documentation
¶
Overview ¶
Package report renders a slice of analysis.Finding values into a single HTML document whose only external reference is the Google Fonts stylesheet; it degrades to the system stack offline. Everything finding-derived comes from analyzed source code, so it is rendered through html/template's contextual auto-escaping — a report must never itself be XSS.
The markup, styling and script are one embedded template file. The stylesheet and script are written out literally in it rather than injected, and neither carries finding data: the script reads only data-* attributes and textContent html/template already escaped. A strict per-render nonce CSP pins both inline tags, which is why nothing may be interpolated into either.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var Version = "dev"
Version is the tool version stamped into machine-readable reports (SARIF and JSON). The CLI sets it at startup (from -ldflags at build time); it defaults to "dev" so tests and un-stamped builds still produce valid output (CI-8).
Functions ¶
func WriteHTML ¶
WriteHTML renders findings as a complete standalone HTML document to w, sorted worst-severity-first then by sink location.
Types ¶
type HTMLOption ¶
type HTMLOption func(*htmlConfig)
HTMLOption configures a WriteHTML render.
func WithScanInfo ¶
func WithScanInfo(info scaninfo.Info) HTMLOption
WithScanInfo supplies the pipeline telemetry behind the report's scan diagnostics section. Without it the section is omitted rather than rendered with zeros.
Source Files